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Abstract —Primary user emulation (PUE) attacks are an 
emerging threat to cognitive radio (CR) networks in which 
malicious users imitate the primary users (PUs) signals to limit 
the access of secondary users (SUs). Ascertaining the identity of 
the devices is a key technical challenge that must be overcome 
to thwart the threat of PUE attacks. Typically, detection of 
PUE attacks is done by inspecting the signals coming from 
all the devices in the system, and then using these signals to 
form unique fingerprints for each device. Current detection and 
fingerprinting approaches require certain conditions to hold in 
order to effectively detect attackers. Such conditions include the 
need for a sufficient amount of fingerprint data for users or 
the existence of both the attacker and the victim PU within the 
same time frame. These conditions are necessary because current 
methods lack the ability to learn the behavior of both SUs and 
PUs with time. In this paper, a novel transfer learning (TL) 
approach is proposed, in which abstract knowledge about PUs 
and SUs is transferred from past time frames to improve the 
detection process at future time frames. The proposed approach 
extracts a high level representation for the environment at every 
time frame. This high level information is accumulated to form 
an abstract knowledge database. The CR system then utilizes this 
database to accurately detect PUE attacks even if an insufficient 
amount of fingerprint data is available at the current time frame. 
The dynamic structure of the proposed approach uses the final 
detection decisions to update the abstract knowledge database for 
future runs. Simulation results show that the proposed method 
can improve the performance with an average of 3 . 5 % for only 
10% relevant information between the past knowledge and the 
current environment signals. 

I. Introduction 

Cognitive radio (CR) is an emerging wireless paradigm that 
enables wireless devices, called secondary users (SUs), to 
share the available spectrum whenever the licensed primary 
users (PUs) are idle Q. However, this dynamic spectrum 
sharing can introduce many security threats, one of which is 
the primary user emulation (PUE) attack Q. In PUE attacks, a 
malicious attacker emulates the PU signals to force legitimate 
SUs to vacate the spectrum even though no real PUs are 
currently present. This type of attacks significantly decreases 
the total performance of legitimate SUs and is detrimental to 
the overall CR system. 

Many defense and detection strategies have been proposed 
to prevent PUE attacks in CR systems. These strategies fall 
into the following main categories: authentication and en¬ 
cryption based such as in j^, localization-based Q, transmit 
power estimation techniques and smart strategies based 
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on supervised machine learning techniques such as in 
and or game theory (Tl. Eor PU authentication and en¬ 
cryption. the authors in proposed to add helper nodes 
to the system that authenticate PUs through link signatures, 
and hence inform SUs with available spectrum. Within the 
scope of localization-based techniques, the authors in 
exploited the received signal strength (RSS) distribution at 
different locations in the system for device fingerprinting. 
However, both the authentication and the localization-based 
techniques will require additional nodes for authentication 
or location reference, which can increase system complexity. 
Localization-based techniques also assume the PUs to be 
stationary with minimal channel variations, which is clearly 
not the case in practical CRs in which users constantly change 
their locations. In Q, the authors estimated the mean and the 
variance of the received power at both a licensed PU and a 
malicious user using Eenton approximation. These estimations 
are compared with the probability ratio test on the received 
signals to detect PUE attacks. However, these techniques 
assume that the transmission power levels of attackers are 
significantly different than the fixed known transmission power 
levels of the PUs. Using neural networks, the authors in 
developed an approach to distinguish between PU and PUE 
attacker. The use of belief propagation was proposed in 0. 
in which each SU calculates the belief based on the local and 
compatibility functions and the beliefs are exchanged between 
neighboring users and then used to detect PUE attacks. The 
work in 0 adopts a game-theoretic approach in which the 
PUE defense problem is a dog fight game between defending 
SUs and the attacker. 

Previous supervised machine learning based techniques such 
as in 0-0 require knowledge about users and authorized 
signals. However, this kind of information is not always 
available in real CR implementations. Device fingerprint¬ 
ing is a process to extract device-specific information 
from the device transmitted signals. These fingerprints form 
signatures that uniquely identify each individual PU or SU 
in the system. Some of the features that can be used as 
fingerprints include the carrier frequency difference (CED), 
phase shift difference (PSD), and second-order cy do stationary 
feature (SOCE). Since device fingerprinting requires no prior 
knowledge about PUs and SUs, unsupervised machine learning 
techniques can be used to detect PUE attacks. The authors 
in |T0| used an unsupervised Bayesian mixture model to clas¬ 
sify fingerprints into different groups. Each group represents 
a unique device in the system. A PUE attack is detected if 


two groups, physical devices, share the same ID, e.g. MAC 
address. Another benefit of the unsupervised techniques is 
that they are passive and require no additional hardware to 
be added to the system unlike localization based techniques. 
However, unsupervised fingerprinting techniques are applied at 
each time frame independently. Therefore, sufficient amount of 
fingerprints is required at each time frame, and it is required 
to have fingerprints for both the malicious attacker and the 
victim PU at the same time frame. 

The main contribution of this paper is to propose a novel 
transfer learning based framework in which knowledge from 
past time frames is transferred to current time frame to 
improve the final PUE attacks detection decisions. To our 
knowledge, this paper is the first to develop a transfer learning 
approach for device fingerprinting. Transferring knowledge is 
significant in fingerprinting scenarios in which an insufficient 
amount of fingerprints is available at the current time frame. 
Our proposed framework extracts abstract information about 
all SU and PU devices in the CR system. This abstract 
knowledge is used to boost the output of an unsupervised 
PUE attacks detection algorithm. The transfer learning part 
in the proposed framework updates the abstract knowledge 
after each time frame. Extensive simulations demonstrates that 
the transfer approach improves the efficiency of PUE attacks 
detection especially in the case of insufficient availability of 
fingerprints. Results show that using the proposed framework 
the performance is enhanced with an average of 3.5% for only 
10% of relevant information between the past knowledge and 
the current environment signals. 

The rest of this paper is organized as follows. Section 
describes our system model. In Section III we explain in 
detail the proposed transfer learning framework. Simulation 
results and discussions are presented in Section |IV| Einally, 
conclusions are drawn in Section El 


II. System Model 


Consider a CR system composed of PUs and SUs, with 
the total number of PUs and SUs being N. Each user has 
a unique identifier (ID), such as a MAC address. Secondary 
users (SUs) can benefit from the spectrum only when all PUs 
are idle. Hence, SUs observe the signals of active PUs to 
avoid using the spectrum when it is used by a licensed PU. 
In this model, we consider a PUE attack scenario in which a 
malicious attacker copies the ID of one of the licensed PUs, 
and, in turn, forces the SUs to vacate the spectrum due to the 
fake PU-like signals sent from the attacker. The PUE attack 
causes a serious security threat and significantly degrades the 
total performance of the CR system. 

Nevertheless, each device in the CR system, whether it 
is a PU or an SU, transmits signals that include device¬ 
specific information, such information is the carrier frequency 
difference (CED), phase shift difference (PSD), and second- 
order cyclostationary feature (SOCE). Such device-specific 
information is known to be unique to each transmitter fTO} , and 
hence cannot be replicated by attackers. The process to extract 
this device-specific information from the transmitted signals is 


called device fingerprinting j^. In device fingerprinting, the 
extracted device-specific information, or fingerprints, forms 
signatures that uniquely identify each device in the system. 
Therefore, even though the PUE attacker shares the same ID 
with a real PU, the fingerprint data for the attacker is different 
from the fingerprint data for the attacked PU. Although our 
model is applicable to any device fingerprint features, we 
restrict our attention to the CED, PSD, and SOCK 

To detect PUE attacks, a nonparametric Bayesian model can 
be used, such as the one in fT0| . In this model, fingerprinting 
data is gathered from all the devices in the system and grouped 
into different clusters. Since fingerprints are unique for each 
device, each cluster of similar fingerprints belongs to one 
device only. Therefore, the number of clusters represents the 
real number of devices N in the system. The number of 
clusters is a key factor to detect the existence of a PUE attack. 
Eor example, if multiple clusters have the same ID, then a PUE 
attack has occurred. 

To form the clusters, one can adopt the nonparametric 
approach proposed by Wood and Black pj] |, that uses the 
infinite Gaussian mixture model (IGMM). In this model, the 
number of clusters, or mixtures, could be infinite. Using an 
IGMM, one can cluster a given set of data points, such 
as the PUs’ and SUs’ fingerprints, by estimating a number 
of Gaussian distributions, where each Gaussian distribution 
represent a cluster. The IGMM therefore requires a mixture 
input and a set of hyper-parameters p. These hyper-parameters 
include priors on the mean and variance of the multivariate 
Gaussian distributions. To integrate the hyper-parameters out 
of the IGMM, the mixture input needs to be generated from 
a distribution that is conjugate to the probability of the 
priors, p(/i/c, cr^|/3) with pk being the mean and being 
the variance. Hence, the Dirichlet distribution is used for the 
mixing probability p{7T\a) with tt being the mixing weights 
and a being the mixing parameter. The Dirichlet distribution 
is given by 

1 ^ 

Dir(Q;i,...,Q;if) = \ (1) 


for all ici,..., wk > 0 where ici H- Vwk = 1- B{a) is the 

beta function, which can be expressed in terms of the gamma 
function as follows: 


B{a) = 


a=ir(a.) 

r(E.=i«0' 


( 2 ) 


The Gibbs sampling process is then used to iteratively assign 
cluster labels to input data vectors, which in our case represent 
assigning fingerprints fi to devices. Gibbs sampler starts by 
initializing clusters for all the fingerprints fi . Subsequently, the 
sampler removes the cluster label for one of the fingerprints 
and calculates its probability for new cluster assignment. The 
sampler iterates until convergence of all device assignments. 
Convergence is guaranteed only for the case of infinite number 
of fingerprints. In the real case in which a finite number of 
fingerprints is available, a maximum number of iterations for 
the Gibbs sampler is chosen as a stopping criterion. 





Such a nonparametric Bayesian method can be applied to 
a given set of fingerprints to detect PUE attacks. However, 
most such existing models, such as in p0| , are static and 
they apply this method independently at every time period. 
However, such static approaches require the CR system to have 
a sufficient amount of unique fingerprints for each device in 
the CR system to construct correct clusters for both the PUs 
and the SUs. In such a nonparametric system, there might not 
be a sufficient amount of fingerprint data for each device in the 
system. Therefore, there is a need to handle the case of having 
an insufficient amount of fingerprints to efficiently detect PUE 
attackers. To address this problem, next, we propose a transfer 
based framework in which fingerprinting results from past time 
frames are used to enhance the current PUE attacks detection. 

HI. Proposed Transfer Learning Eramework 

To enhance the fingerprinting process in a CR network, we 
use the powerful mathematical tool of transfer learning (H 
In particular, we propose a new transfer learning based frame¬ 
work for device fingerprinting, as illustrated in Eig. 

The proposed framework consists of two main components. 
The first is the abstract knowledge database (AKD), which 
is able to gather general information about devices in the 
CR system from all time frames. The second component is 
the transfer tool that updates the stored abstract knowledge 
database with the current time frame information. The pro¬ 
posed framework receives the current fingerprint data from 
the environment, and suggests a clustering for the received 
fingerprint data based on the knowledge in the AKD. The clus¬ 
tering decisions from the proposed framework are merged with 
the clustering decisions of the static nonparametric Bayesian 
model to form a final clustering decisions. These final clus¬ 
tering decisions represent the assignment of fingerprint data 
to devices in the CR system. The transfer tool updates the 
AKD with the final clustering decisions for future PUE attacks 
detection. 

Next, both the abstract knowledge database and the transfer 
learning algorithm will be described in detail. 

A. Abstract Knowledge Database 

The abstract knowledge database (AKD) includes general 
information about the devices in the CR system starting from 
time to, when the system was first deployed, and until the 
current time instant t. The information stored in the AKD 
consists of a set of fingerprints , with DB referring 
to the abstract knowledge database, grouped into multiple 
clusters ..., C^}, where each cluster represents 

a device in the CR system. The AKD block in Eig. 
shows an example of 3 clusters of fingerprints. Hence, each 
fingerprint G has a corresponding cluster label 

G ..., C^} and a weight value Wi. Weights 

represent the amount of confidence in assigning fingerprint 
to cluster To reduce the number of fingerprints in 
the AKD, a similarity metric is introduced, which replaces two 
or more fingerprints ... } G that are nearly 

identical with new fingerprint fy^, where fy^ minimizes the 



Eig. 1: Framework of the detection system with the proposed TL 
approach 

distances between • • • }: 

fS'^ex 

where d is a distance measure and A' is the set of similar fin¬ 
gerprints: A' = {/f^, ... } such that V(/f^, G A', 

< e. Hence, the new set of fingerprints 

in the AKD equals to: \ {A'}. 

Eor instance, if the distance measure is the 12-norm and 
we have two fingerprints {/f^, with high similarity, 

< e then the new fingerprint using ^ will 
simply be the mean of both {/f^, The distance threshold 
e defines how close fingerprints need to be in order to be 
considered similar. Large values of e allow more fingerprints 
to be merged and hence will result in a very generic abstract 
knowledge in the AKD. On the other hand, small values of e 
tighten the similarity condition and result in a highly specific 
information in the AKD. 

When a new set of input fingerprint data T arrives from 
the environment, the goal is to group these fingerprints into 
clusters. In order to group the input fingerprints T, the 
model compares these newly arriving fingerprints T with 
the fingerprints stored in the AKD to find the set of 
fingerprints C which is as close as possible to the 
input fingerprints ji C T. Next, we use the clustering labels 
of as a suggested clustering labels for jg. The model also 
uses the weights Wi associated with each fingerprint in the 
AKD to provide a confidence level along with each suggested 
clustering label. A sigmoid logistic growth function is chosen 
to calculate the amount of confidence for each fingerprint in 
the database: 

CFi = - - A - ( 4 ) 

1 + bx 

where CFi is the confidence weight for the fingerprint wi 
is the weight associated with the fingerprint in the AKD, 
b and c are the parameters of the logistic function that control 
how steep the logistic function is which in turn affects the level 
of confidence assigned to each weight. The initial weights are 
chosen near the middle, based on the amount of confidence 






















Algorithm 1 Boosting labels of the Bayesian model 

Input: Set of fingerprint data T from the environment 
Output: Set of labels and confidence values CFi for all 
fingerprints fi 

1 : for each fingerprint ji in the input do 

2 : for each fingerprint in the AKD do 

3: Calculate similarity between and 

4: end for 

5: idx 2 (of the similar to fi) 

6 : ^ labels of 

7: CFi = 1/[1 + 6 X exp (—c X Widx)] 

8 : end for 

9: return clustering labels confidence CF 

that we want to assign to the newly added fingerprints in the 
database. 

At specific time intervals, all the weights in the database are 
decreased by a fixed amount to reduce the confidence in old 
fingerprints which have not been used in the past several time 
frames. The parameters b and c in 0 determine how long it 
takes for a fingerprint to be considered old and be removed 
from the AKD. 

Therefore, the output of our proposed framework is a 
set of suggested clustering labels for the input fingerprints 
fi. A confidence weight is also provided along with each 
suggested clustering label. The suggested clustering labels 
from our proposed framework boost the clustering decisions 
of the Bayesian model to construct final clustering labels. The 
boosting process pseudocode is shown in Algorithmic 

B. Transfer Tool 

The purpose of the transfer tool is to use the final output 
decisions to update the AKD. At each time frame, both 
the Bayesian model and our proposed framework receive 
the current fingerprints fi from the environment, and group 
these fingerprints into clusters Cf^ and respectively. The 
decision block, shown in Fig. [C merges the output of the 
Bayesian algorithm (fi^Cf^) and the output of the proposed 
framework {fi^Cf^) into a final output decision (fi^Ci), 
where fi is the input fingerprints, Ci is the final cluster labels 
assignment. Since the final decisions have different labels than 
the labels in the AKD, a mapping of labels is needed. The 
transfer tool finds the right mapping of final decision labels 

Ci to the labels in the AKD by solving: 

S' 

imn ^ / (M (Ci), Cf®), (5) 

i=l 

where S is the total number of fingerprints m F, M = 
[mi, m 2 ,... ,m^] is the mapping vector between final clus¬ 
ter labels and cluster labels in the AKD such that rrij G 
{ 1 , 2 ,. ..,y}, where V is the number of labels, for any two 
elements mj and rrik of M^rrij 7 ^ rrik, I is an indicator 
function in which / = 0 when M {Ci) = Cf^ and 1 = 1 
when M{Ci) 7 ^ Cf^. For example, in the case of 2 clusters 
only, M can take two possible values: M = [1, 2] or [2,1]. 

After finding the right mapping of the labels from the final 
clustering output Ci to the clustering labels Cf^ in the AKD, 


Algorithm 2 Updating the AKD 

Input: Fingerprint data fi from the environment, and simi¬ 
larity levels between fingerprints fi from the environment 
and fingerprints f^^ from the AKD 
Output: Updated AKD 

1 : Find the mapping of labels M (between framework output 
labels and final output labels). 

2 : for each fingerprint fi with high similarity to fingerprint 
ff^ in the AKD do 
3: if fi label match the f^^ then 

4: increase the weight of ff^ by Wstepjnc 

5: else 

6 : decrease the weight of ff^ by Wstep_dec 

7: add the new label mapping of fi to the AKD with 

initial weight Winit 

8 : end if 

9: end for 

10 : for each fingerprint fi with low similarity to fingerprint 
f^^ in the AKD do 

11 : add the new fingerprint fi with its label to the AKD 

with initial weight Winit 

12: end for 

13: decrease all weights for all fingerprints in the AKD by 1 

the transfer tool updates the existing fingerprints ff^ in the 
AKD with the final output labels of the input fingerprints 
fi. In the update process, the input fingerprint data fi is 
divided into two categories: fingerprints with high similarity 
to the fingerprints f!^^ in the AKD, and fingerprints with 
low similarity to the fingerprints f!^^ in the AKD. In the 
high similarity case, we increase the weights Wi for all the 
fingerprints in the AKD that are of high similarity to 
the input fingerprints fi to give these fingerprints a higher 
confidence weight. As for the fingerprints with low similarity, 
the input fingerprints fi are considered new to the AKD and 
are added to the AKD with initial associated weights Winit- 
The algorithm used to update fingerprints in the AKD is shown 
in Algorithm]^ After specific time intervals, the weights for 
all the fingerprints in the database are decreased by 1 to 
penalize for old unused fingerprints. All the fingerprints f^^ 
with weights below a certain threshold are removed from the 
AKD database. 

IV. Simulation Results and Analysis 

For our simulations, we consider the nonparametric 
Bayesian method as our static PUE attacks detection model, 
and we evaluate the benefits of using our proposed transfer 
based framework to enhance the detection of the PUE attacks 
in the CR system. 

A. Parameter Selection and Data Generation 

Even though the hyper-parameters /3 were integrated out 
of the iterative Gibbs process as shown in Section an 
appropriate choice of hyper-parameters p affects the speed 
of convergence of the Gibbs sampler. The hyper-parameters 
P consist of priors to the jik and cFk of the multivariate 
Gaussian distributions. For example. The mean prior /io is 
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Fig. 2: Comparison between the proposed transfer learning approach and the traditional static approach (a) hit rate vs number of fingerprints 
(b) efficiency of using transfer learning vs number of fingerprints (c) percentage of PUE attacks detection vs number of fingerprints 


usually set to be close to the mean value of all the fingerprints. 
The hyper-parameter /^o, which is proportional to prior mean 
for cT/c, determines how likely the fingerprints are to be 
variant from each others. Therefore, for features like signal 
amplitude, a large value of kq is chosen since signal amplitude 
feature has large variance between fingerprints. On the other 
hand, frequency features tend to have small variance between 
fingerprints and hence a small value of /^o is chosen for these 
features. The Dirichlet distribution is used in the generation 
of the fingerprints for the simulations. Random means and 
variances are used for each label. 

B. Experiments and Analysis 

In this section, we evaluate the performance of the non- 
parametric Bayesian model with and without our proposed 
transfer learning framework. We use two main metrics for 
evaluation: (i) The hit rate of assigning the right label to 
each fingerprint, which is equals to the percentage of correctly 
assigned labels to fingerprints compared to the total number 
of fingerprints, (ii) Missed attack rate, which is an indicator 
that missclassifying some fingerprints led into missclassifying 
a user in the system. 

The second metric provides a better indicator on the per¬ 
formance enhancement due to using the transfer learning 
framework, this is due to the fact that even with high hit 
rate percentages, an attacker might not be detected if all the 
missciassified fingerprints belong to this attacker. On the other 
hand, even with low hit rate, accurate detection of attackers can 
be achieved if the missciassified fingerprints are distributed on 
various users. The conducted experiments were repeated 500 
times and final results were averaged. The number of users 
chosen is 8 with total number of fingerprints ranging from 
100 to 1000 fingerprints. An upper bound on the transfer 
learning approach is shown in the plots, which presents the 
maximum hit rate possible with perfect transferred knowledge. 
This upper bound curve gives us an insight on the maximum 
performance that our proposed transfer approach can achieve. 

In Fig. we show the hit rate resulting from the different 
learning approaches as the number of fingerprints varies. 
From this figure, we can see that our proposed framework 
achieved an average enhancement of 3.5% in total hit rate (for 


100 fingerprints) with only 10% of transferable knowledge. 
Fig. also shows that the transfer learning upper bound curve 
yields to highest output hit rate if all the 10% transferable 
knowledge were completely used. The figure also shows that 
the maximum performance enhancement that can be reached 
through transfer learning is around 4.1% making our model 
up to 75% close to the optimal transfer case. As expected the 
more fingerprints we have that describes users the better the 
clusters are which yields to a higher total hit rate. 

Fig. 1^ shows the efficiency of using transfer learning as 
the number of fingerprints increases. As more fingerprints are 
available, there is less need to transfer knowledge and, thus, 
the amount of performance improvement resulting from the 
proposed approach will naturally decrease. This is due to the 
fact that having a large number of fingerprints will yield in 
a better clustering of labels by the detection algorithm which 
leaves small room of enhancement for the transfer approach. 

In Fig. 1^ we show the number of times that the proposed 
transfer learning approach managed to correctly classify a PUE 
attacker that was missciassified in the traditional detection 
approach. As the number of fingerprints increases, missclas¬ 
sifying an attacker is less likely to happen. This is due to the 
fact that even if some fingerprints were missciassified, having 
other correctly classified fingerprints insures that the attacker 
is correctly detected. Fig. shows that for 100 fingerprints 
the proposed transfer approach detects 23% of the times an 
attacker which was not detected in the traditional non-transfer 
approach. 

Fig shows the effect of increasing the number of devices 
on the total hit rate for a fixed number of fingerprints for 
each user. In this experiment, we obtain 25 fingerprints for 
each user. As expected the hit rate decreases as the number 
of devices increases. For a fixed 10% transferable information 
from past time frames, the figure shows that the effect of the 
proposed method increases as the number of devices increases, 
this is due to the fact that having 25 fingerprints for each 
user is sufficient in the 10 users case, and as the number 
of users increases, more fingerprints are needed to correctly 
cluster users; and hence the more effective the transfer learning 
approach becomes. 








































































Hit rate vs number of devices (with/without the transfer approach) 



Fig. 3: Hit rate comparison between the proposed and the traditional 
approaches with respect to the number of devices 

V. Conclusion 

In this paper, we have proposed a novel approach for 
performing device fingerprinting in wireless networks. In 
particular, we have introduced a novel framework, based on the 
machine learning tools of transfer learning, that enable static 
detection algorithms to benefit from past detection results. We 
have applied the framework for fingerprinting PUs and SUs 
in a cognitive radio network. Our results have shown that 
the proposed framework enhanced the performance with an 
average of 3.5% for only 10% relevant information between 
the past knowledge and the current environment fingerprints. 
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